Module and release scope
This guide covers NOWPayments Crypto Payments 1.0.0, Extension API 1, from the reviewed product source. Its declared core range is 1.3.6–1.3.99. Use the matching released core and signed provider package; a version label alone does not install the required contracts. Source availability does not mean the module is bundled in every currently downloadable product, installed on your server, enabled or certified for your merchant/server account. Nothing in this guide enables a provider or changes your existing connections.
Open System → Payment gateways (newer source may group these as Payments, Domain services or Hosting services). Install the reviewed signed package through Modules & addons or the integration workspace's Install tab, enable the module separately, add an account/connection, save its own credentials, run its stated Test and explicitly enable the connection. Saving or retesting disables the connection until you enable it again. Start with the provider's test environment where supported; otherwise use an isolated account or server.
Exact connection fields
These are the fields declared by this module. Secret values are entered privately and encrypted by the application. Defaults are configuration hints, not approved live merchant settings. Internal fields are populated by the module and are not operator-editable.
| Key / label | Type | Required | Default / guidance |
|---|---|---|---|
mode — Environment |
select | Yes | Default: "sandbox" Choices: sandbox = Sandbox, live = Live |
api_key — Store API key |
secret | Yes | Use the account-specific value described below. |
ipn_secret — IPN secret key |
secret | Yes | Generate it in Store settings. Final payment notifications are required; a success redirect cannot confirm payment. |
Create a NOWPayments store, configure its payout wallet and generate a store API key plus IPN secret in Store settings. Use separate sandbox/live accounts and keys. Test reads the merchant coin configuration; it never creates an invoice or sends funds.
Supported fiat invoice currencies: USD EUR GBP AUD CAD CHF NZD PLN BRL ZAR TRY, subject to provider support. Hosted checkout lets the payer choose an available cryptocurrency. The fixed fiat invoice price is preserved; the application does not calculate a conversion rate.
The full connection webhook URL is submitted as ipn_callback_url on every invoice. The IPN secret is required. The module validates the recursively sorted JSON HMAC-SHA512 x-nowpayments-sig signature, then re-reads the payment with the store API key. Only finished with full crypto pay_amount received, matching order UUID and fiat amount/currency can settle. Partially paid, confirming, refunded, failed and expired states do not settle.
This provider module is webhook driven: the browser success URL does not contain authoritative payment evidence. If IPN delivery is missing, keep the attempt under review and resend the final payment notification from the provider dashboard. Reconciliation never guesses that an invoice is paid from its redirect.
Sources: https://nowpayments.io/payment-integration https://documenter.getpostman.com/view/7907941/S1a32n38 https://nowpayments.io/blog/nowpayments-api
Install and configure
This is an API 1 payment module for the current product source (core 1.3.6). It installs disabled and contains no account credentials. In Payments → Available, open this provider, enable its module after reviewing it, then add a merchant account. Save credentials, run Test and explicitly enable the account. Merchant onboarding and payment-method approval remain with the provider.
Only the listed invoice currencies are supported, using exact two-decimal amounts. Domain/storefront currency is not silently converted. The hosted provider page chooses methods available for the merchant, payer and country. The application never collects a card number or CVV.
The account’s full webhook URL is shown after saving. Register that one HTTPS URL for every storefront sharing the account. Browser success messages never mark an invoice paid. Pending, declined, partly paid, authorization-only and refunded payments require their actual provider state; no automatic refund is requested. Test uses authentication/read-only metadata, never a charge. API diagnostics are redacted.